0.0
NA
CVE-2026-68146
ftrace: Add global mutex to serialize trace_parser access
Description

In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize trace_parser access In ftrace, the trace_parser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user input. The affected handler paths and their specific functions are: - Open paths: ftrace_regex_open(), ftrace_graph_open() - Write paths: ftrace_regex_write(), ftrace_graph_write() - Release paths: ftrace_regex_release(), ftrace_graph_release() If userspace opens a trace file descriptor and shares it across multiple threads, concurrent write calls will race on the parser's internal state, specifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted input or undefined behavior. Fix this by adding a global mutex, parser_lock, to serialize all access to trace_parser across write and release paths, preventing concurrent corruption of parser state.

INFO

Published Date :

Aug. 10, 2026, 1:20 p.m.

Last Modified :

Aug. 10, 2026, 1:20 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-68146 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
Solution
Serialize trace_parser access with a global mutex to prevent concurrent corruption.
  • Apply the kernel patch for ftrace race condition.
  • Ensure trace_parser access is serialized.
  • Update the Linux kernel.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-68146 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-68146 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-68146 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-68146 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 10, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '689fd8b65d669b96d612ccc37d6fb87bf7ed6907', 'lessThan': '3d0dd138a06c782f8b755cd1b6f9909494514ce1', 'versionType': 'git'}, {'status': 'affected', 'version': '689fd8b65d669b96d612ccc37d6fb87bf7ed6907', 'lessThan': '90be137813e1a5bdfd671e40fe28004fb959d3e4', 'versionType': 'git'}, {'status': 'affected', 'version': '689fd8b65d669b96d612ccc37d6fb87bf7ed6907', 'lessThan': '65bf73bee1a4f3722208ae46afc0fa5de76b9a0a', 'versionType': 'git'}, {'status': 'affected', 'version': '689fd8b65d669b96d612ccc37d6fb87bf7ed6907', 'lessThan': 'e807c9193d9493c7a0d039158ebb955050a76df1', 'versionType': 'git'}, {'status': 'affected', 'version': '689fd8b65d669b96d612ccc37d6fb87bf7ed6907', 'lessThan': '7720b63bcef3f54c7fe288774b720a227d54a306', 'versionType': 'git'}], 'programFiles': ['kernel/trace/ftrace.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.32'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.32', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['kernel/trace/ftrace.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize trace_parser access In ftrace, the trace_parser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user input. The affected handler paths and their specific functions are: - Open paths: ftrace_regex_open(), ftrace_graph_open() - Write paths: ftrace_regex_write(), ftrace_graph_write() - Release paths: ftrace_regex_release(), ftrace_graph_release() If userspace opens a trace file descriptor and shares it across multiple threads, concurrent write calls will race on the parser's internal state, specifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted input or undefined behavior. Fix this by adding a global mutex, parser_lock, to serialize all access to trace_parser across write and release paths, preventing concurrent corruption of parser state.
    Added Reference https://git.kernel.org/stable/c/3d0dd138a06c782f8b755cd1b6f9909494514ce1
    Added Reference https://git.kernel.org/stable/c/65bf73bee1a4f3722208ae46afc0fa5de76b9a0a
    Added Reference https://git.kernel.org/stable/c/7720b63bcef3f54c7fe288774b720a227d54a306
    Added Reference https://git.kernel.org/stable/c/90be137813e1a5bdfd671e40fe28004fb959d3e4
    Added Reference https://git.kernel.org/stable/c/e807c9193d9493c7a0d039158ebb955050a76df1
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.